CVE-2012-4464: Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068 allows context-dependent attackers to bypas...

Security readout for executives and security teams

This is a Ruby safe-level bypass. In affected Ruby builds, specific error-to-string APIs could undermine sandbox assumptions by changing string trust state. The business risk is mainly for legacy Ruby systems that depended on Ruby safe levels to isolate untrusted code or data. Exposure is likely limited to legacy Ruby deployments using Ruby 1.9.3 before p286 or Ruby 2.0 code before r37068, especially where $SAFE-style sandboxing was part of the security model. Treat this as a legacy exposure cleanup item unless safe-level sandboxing protects sensitive workflows. Prioritize affected systems that process untrusted code or tenant-controlled input. Mitigation focus: Inventory Ruby runtimes and embedded Ruby interpreters.; Upgrade Ruby 1.9.3 to patchlevel 286 or later.; Use Ruby 2.0 code at revision r37068 or later where applicable..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.